CVE-2025-71469

CVSS 6.8 (medium) · published 2026-11-15

GPAC before 26.02.0 contains a type confusion vulnerability in ctxload_process() that passes non-object descriptors to ODS_SetupOD() without checking the descriptor tag. Attackers can supply a crafted XMT file with a URL-bearing descriptor that crashes MP4Box or other GPAC-based applications in gf_scene_ns_connect_object(), causing denial of service.

Weakness: CWE-843

Source: NVD CVE-2025-71469

References

• https://github.com/gpac/gpac/blob/v2.4.0/src/filters/load_bt_xmt.c#L649-L656
• https://github.com/gpac/gpac/commit/62714f27c64a3d1eb7e880f9eed2d38673cb43ce
• https://github.com/gpac/gpac/issues/3271
• https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/30/30_compositor_scene_ns_c_479_in_gf_scene_ns_connect_object
• https://www.vulncheck.com/advisories/gpac-before-26.02.0-type-confusion-dos-via-xmt-bt-scene-loader

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.